Hermitic Builds
Every build carries a number: the count of entropy sources standing between its source and a bit-for-bit reproducible binary. The goal is to drive it to zero.
CHE → 0
Entropy sources between source and binary
HASH1–5
A complete provenance record
Bitwise
The reproducibility target
Nobody can rebuild the binary they shipped.
Corporate governance keeps the source, sometimes the build container, almost never the resolved toolchain. When a binary has to be reproduced years later for an audit, a liability claim or a forensic reconstruction, the exact inputs are already gone.
Non-determinism does the rest quietly — build-time temp files, urandom, clock-based compiler optimizations, uninitialized memory, host config — and almost no one is measuring how much of it a given build contains.
Make reproducibility a number.
01
Seal the build
The whole build runs in a container: source bind-mounted read-only, results read-write, and every tool and system header baked immutably into the image. An strace pass records every file, network, time and /proc access that leaks in.
02
Classify every input
Files accessed outside the source tree are traced to their originating packages; the known set is folded back in for reproducibility, and the unknown set is exactly the entropy left to eliminate.
03
The CHE metric
Charlton Hermitic Entropy counts the entropy sources that prevent a reproducible build, from source-and-toolchain to container to binary. It turns reproducibility from an aspiration into a number engineering can drive to zero — and a KPI leadership can be held to.
Five hashes, one chain.
Each build emits a chain of hashes: the parent image, the built container, the resolved package metadata, the source commit and the product binary. Their union is a complete provenance record, and a pair like the container and its source uniquely identifies a binary.
The inputs are archived in immutable, owned repositories for the support window plus the liability statute — often decades — and can be logged to an immutable ledger, so any released product can be reconstructed and verified long after the machine that built it is gone.
Tooling, and honest measurement.
| Milestone | Status | Evidence |
|---|---|---|
| Hermetic build + leak detection | Running | strace-based tooling |
| CHE metric + package classification | In progress | On FOSS examples |
| Bitwise-stable rebuilds | In progress | Reproducibility study |
| Provenance archival + ledger | Next | — |
Figures on this page are targets and internal measurements at proof-of-concept stage. We share the methodology with anyone who wants to run it.
Publish the number.
Next is publishing the toolkit and sample CHE calculations for large open-source projects — Android, Linux, PostgreSQL — and pushing representative builds toward bitwise-stable rebuilds.
Hermitic Builds spins out of Research ByIQ once CHE is something teams can compute, report and drive down inside their own pipelines.